Android apps may share user location data with advertisers by default

According to the EFF, once a user grants an app permission to access their location, this data can be automatically collected and shared by SDKs. The organization is urging app makers to actively disable unnecessary data collection by these SDKs. While advertising SDKs are often used to monetize apps, the byproduct is the feeding of user location histories to data brokers, who then monetize and sell this information to entities such as militaries and intelligence agencies. This practice also poses a security and privacy risk if the data is hacked or stolen.

The EFF's findings are based on an analysis of network traffic from various Android apps. Among the apps identified were two that have been downloaded a combined 60 million times. Bill Budington, a senior staff technologist at EFF, noted that while the examined SDKs represent a small portion of the advertising ecosystem, their reach is extensive, potentially impacting billions of users across tens of thousands of apps. The EFF emphasized that app-level location permissions alone do not provide meaningful consent for data collection and sharing by third-party advertising SDKs, advocating that such SDKs should not make personal data sharing the default, especially for sensitive information like location.